Authentication information transmission method, authentication information transmission system, storage medium and device

Abstract

The present application provides an authentication information transmission method, which is applied to an authentication information sending module in a terminal, including: obtaining authentication information of a data packet to be sent in a TCP long connection; wherein the TCP long connection is a TCP long connection established between a client in the terminal and a server; constructing an authentication data packet; sending the authentication data packet to an authentication information receiving module of the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server. In the present application, the communication security of the business system can be improved without updating communication equipment and communication protocols, reducing the communication upgrade cost of the business system, and having no additional business impact on the business system. The present application also provides an authentication information transmission system, a computer-readable storage medium, and an electronic device, which have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an authentication information transmission method, an authentication information transmission system, a storage medium, and an electronic device. Background Art

[0002] Currently, many business systems face communication security risks and require the transmission of authentication information. A common approach is to use tokens, which need to be included in the request data stream during protocol design. For example, HTTP typically uses URL parameters to store tokens, such as https: / / www.example.com / uri?token=12345678.

[0003] However, this approach requires upgrading the business system. However, enterprises use a large number of business systems, and they belong to different manufacturers. Upgrading the business systems is very difficult, resulting in time-consuming, costly, and inefficient security upgrades of business systems, which brings many hidden dangers to the enterprise's business.

[0004] If business system upgrades are not considered, another method is to write authentication information into the option field of the TCP header or IP header of the message. However, due to the length limit of the TCP header and the IP header, there are not enough bytes available to store the authentication information, which may also cause the authentication information to fail to be sent.

[0005] Therefore, how to improve the security of business systems is a technical problem that technical personnel in this field urgently need to solve. Summary of the Invention

[0006] The purpose of this application is to provide an authentication information transmission method, an authentication information transmission system, a storage medium and an electronic device, which can improve the communication security of a business system by adding authentication information without modifying the communication protocol of the business system.

[0007] To solve the above technical problems, the present application provides an authentication information transmission method, which is applied to an authentication information sending module in a terminal, and the method includes:

[0008] Obtaining authentication information of a data packet to be sent in a TCP persistent connection; wherein the TCP persistent connection is a TCP persistent connection established between a client in the terminal and a server end of the server;

[0009] Constructing an authentication data packet, wherein the authentication data packet includes: a quintuple of the data packet to be sent and authentication information, and the data packet to be sent also includes a TCP sequence number or a TCP sequence number range;

[0010] The authentication data packet is sent to the authentication information receiving module of the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server.

[0011] Optionally, the authentication information includes at least one of user identity information, session identifier, process information and terminal environment information.

[0012] Optionally, the authentication information receiving module that sends the authentication data packet to the server includes:

[0013] The authentication data packet is sent to the authentication information receiving module based on a third-party connection independent of the TCP long connection.

[0014] Optionally, the third-party connection is a UDP connection.

[0015] Optionally, the authentication information receiving module that sends the authentication data packet to the server includes:

[0016] Based on the TCP long connection, the authentication data packet is sent to the authentication information receiving module of the server; wherein the five-tuple of the authentication data packet is consistent with the five-tuple of the long connection, and carries authentication data packet identification information to indicate that it is an authentication data packet.

[0017] Optionally, the authentication data packet is identified as an authentication data packet by setting the TCP sequence number of the authentication data packet to an illegal sequence number.

[0018] Optionally, the sending time of the authentication data packet is earlier than the sending time of the corresponding data packet to be sent, so that the authentication information receiving module obtains the authentication information before receiving the data packet to be sent, thereby performing access control.

[0019] This application also provides an authentication information transmission system, including:

[0020] An authentication information acquisition module, configured to acquire authentication information of a data packet to be sent in a TCP persistent connection; wherein the TCP persistent connection is a TCP persistent connection established between a client in the terminal and a server end of the server;

[0021] An authentication data construction module is used to construct an authentication data packet, wherein the authentication data packet includes: a five-tuple of the data packet to be sent and authentication information, and the data packet to be sent also includes a TCP sequence number or a TCP sequence number range; a communication module is used to send the authentication data packet to the authentication information receiving module of the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server.

[0022] The present application also provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the above-described method when executed by a processor.

[0023] The present application also provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned method when calling the computer program in the memory.

[0024] The present application provides an authentication information transmission method, which is applied to an authentication information sending module in a terminal, comprising: obtaining authentication information of a data packet to be sent in a TCP long connection; wherein the TCP long connection is a TCP long connection established between a client in the terminal and a server; constructing an authentication data packet, wherein the authentication data packet includes: a five-tuple of the data packet to be sent and authentication information, and the data packet to be sent also includes a TCP sequence number or a TCP sequence number range; and sending the authentication data packet to an authentication information receiving module on the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server.

[0025] This application constructs an authentication data packet by obtaining the authentication information of the data packet to be sent, and transmits the authentication data packet to enable the server to confirm the authentication information of the data packet to be sent, so as to authenticate the data packet to be sent through the five-tuple and the authentication information carried in the authentication data packet. Moreover, the authentication data packet does not need to change the original communication protocol of the business system itself, is independent of the business system, and does not utilize the option field in the header of the original data packet. Instead, it adopts a plug-in-like authentication method, so that the server can perform access verification on the data packet sent by the terminal based on the authentication data packet, so as to improve the communication security of the business system for subsequent audit and / or control. There is no need to update the communication equipment and communication protocol, which reduces the cost of communication upgrade of the business system, and has no additional business impact on the business system.

[0026] The present application also provides an authentication information transmission system, a computer-readable storage medium, and an electronic device, which have the above-mentioned beneficial effects and are not described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0028] Figure 1 A flowchart of a method for transmitting authentication information provided in an embodiment of the present application;

[0029] Figure 2 A schematic diagram of the structure of an authentication information transmission system provided in an embodiment of the present application:

[0030] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0032] See also Figure 1 , Figure 1 This is a flowchart of a method for transmitting authentication information provided in an embodiment of the present application. The method for transmitting authentication information includes:

[0033] S101: Acquire authentication information of a data packet to be sent in a TCP persistent connection; wherein the TCP persistent connection is a TCP persistent connection established between a client in the terminal and a server;

[0034] This step aims to obtain authentication information. There is no limitation on how to obtain authentication information. Typically, authentication information can be obtained from the service initiator or the service initiator's supervisor. The service initiator can generate authentication information that includes information about itself and access.

[0035] The specific content of the authentication information is not limited here, and it can include at least one of the user identity information, session identifier, process information, and terminal environment information of the service initiator itself, or a combination of any of them. Of course, the specific format of the authentication information is not limited here, and it can be any format of data agreed upon by both parties to the service. It is easy to understand that before executing this step, the authentication information can be generated based on the access rights, session identifier, at least one of the application environment information of the service initiator, and the identity information of the service initiator. Of course, the authentication information can also include other information used to perform verification, which is not limited by examples one by one here.

[0036] Furthermore, if the authentication information includes real-time information about the service initiator, such as the current application environment, the authentication information acquisition process can be a continuous, repetitive operation, i.e., multiple acquisitions of authentication information from the TCP persistent connection. For example, if the service initiator is suddenly infected with a virus, their application environment will have significantly changed. Their authentication information can also include application environment information that records the service initiator's current state. This allows the service recipient and the server's authentication information receiving module to verify the authentication information and confirm that the TCP persistent connection initiated by the service initiator may contain a virus, thereby promptly blocking access.

[0037] S102: Construct an authentication data packet;

[0038] This step is intended to construct an authentication data packet, which includes at least: a five-tuple of the data packet to be sent and authentication information, and the data packet to be sent also includes a TCP sequence number or a TCP sequence number range. The five-tuple mainly refers to the source IP address, source port, destination IP address, destination port, and transport layer protocol. As can be seen, this step assumes that before executing this step, the five-tuple and authentication information of the data packet to be sent, as well as information such as the TCP sequence number or the TCP sequence number range, have been obtained. This step does not specifically limit how to obtain information such as the five-tuple.

[0039] In one feasible method, the sending action of the message in the TCP long connection can be detected to determine the existence of the message to be sent, and then an authentication data packet can be constructed based on the message to be sent. In an embodiment of the present application, not every message to be sent will necessarily correspond to an authentication data packet. If the authentication information is consistent with the previous authentication data packet when sending the message to be sent, there is no need to send the authentication data packet again. The authentication data packet will only be sent again when the authentication information changes.

[0040] In addition, this step does not specifically limit how to construct the authentication data packet, nor does it limit the specific format and type of the authentication data packet. It can be constructed in the same data packet format as a TCP data packet, or it can adopt the UDP protocol, or the data packet format of other protocol types.

[0041] S103: Send the authentication data packet to the authentication information receiving module of the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server.

[0042] This step is intended to send the authentication data packet to the authentication information receiving module of the server. There is no limitation on how to send the authentication data packet.

[0043] There is no limitation on how to transmit the authentication data packet. This embodiment provides two methods:

[0044] In the first approach, a third-party connection independent of the TCP persistent connection can be established, and the authentication packet can be transmitted to the service recipient through the third-party connection. For example, if the third-party connection is a UDP connection, a UDP message can be constructed as the authentication packet. It is important to note that the authentication packet must include the data sequence number or data sequence number range of the TCP persistent connection. For example, a TCP stream contains a SEQ number (sequence number) during transmission, which is typically transmitted in numerical order. If the TCP persistent connection contains authentication packets from multiple service initiators, to avoid confusion, it is necessary to ensure that each service initiator's authentication packet corresponds to its own data packet. Specifically, the authentication packet should be configured with the sequence number or sequence number range corresponding to the service initiator. If the sequence number of service initiator A's data packet is between 1000 and 2000, its corresponding authentication packet should also include the data sequence number range or directly include sequence number 1000. If 2001 replaces the authentication information, the authentication packet will include sequence number 2001. This allows the service recipient to identify the service initiator based on the sequence number. At this time, the TCP long connection can correspond to multiple authentication data packets, and each service initiator corresponds to at least one authentication data packet.

[0045] In this method, the authentication packet transmission process, known as the third-party connection, is independent of the TCP persistent connection (normal business communication). Furthermore, the authentication packet transmission process is not constrained by the business system's communication protocol. Simply pre-configuring a third-party communication method that does not affect business transmission is sufficient. In practice, this third-party communication method is extremely simple during normal business system communication, such as TCP or UDP transmission.

[0046] In the second method, the authentication data packet needs to be interspersed with the TCP persistent connection for transmission, that is, the authentication data packet is added to the TCP persistent connection, and the communication configuration of the authentication data packet using the TCP persistent connection is set. In other words, the authentication data packet is sent through the established TCP persistent connection instead of through another connection independent of the TCP persistent connection.

[0047] The five-tuple of the authentication packet is configured to match the five-tuple of the TCP persistent connection. This ensures that the authentication packet includes the five-tuple of the data packet to be sent. Furthermore, to distinguish it from the data packets sent by the TCP persistent connection itself, the authentication packet must also include identification information indicating that it is an authentication packet. In one possible implementation, this identification information can be an illegal sequence number. An illegal sequence number is a sequence number that cannot exist in a normal data packet within the TCP persistent connection. The specific identification information selected can be determined based on actual circumstances.

[0048] For illegal serial numbers, the server's kernel protocol stack cannot recognize them and will automatically discard them. Therefore, after obtaining the authentication data packet, the authentication information receiving module can directly return it to the kernel protocol stack, which will discard it.

[0049] During TCP transmission, each data packet contains a sequence number that identifies the current data position. These numbers are typically sorted numerically to prevent out-of-order data from being received. For example, the sequence number is 1…100…200. However, if the sequence number is 1…100…4100…200, the illegal sequence number 4100 appears in the middle. The authentication packet receiving module will consider the packet to be out of the window. At this point, the authentication packet is identified as an authentication packet and, after verification, is returned to the kernel protocol stack, which discards it. This prevents authentication packets, transmitted as data packets, from interfering with normal service data transmission.

[0050] For the authentication message receiving module, after determining that data with an illegal sequence number has been received, a TCP long connection is used to restore the data packet to an authentication data packet and perform access verification on the authentication data packet. After the access verification is completed, the protocol stack is used based on the TCP transmission principle to discard the data packet containing the illegal sequence number.

[0051] It's important to note that the authentication message sending module can transmit the authentication message before sending the response data message over the TCP persistent connection, essentially synchronizing the transmission with the TCP persistent connection as much as possible. The authentication message sending module can be preconfigured to implement configurations such as authentication packet packaging and sending before the authentication data packet is sent. Correspondingly, an authentication message receiving module can also be configured on the server to implement functions such as receiving, parsing, and verifying the authentication data packet.

[0052] In addition, the embodiments of the present application do not limit the order of transmission of the authentication data packet and the data packet to be sent. In a feasible way, the sending time of the authentication data packet can be set earlier than the sending time of the corresponding data packet to be sent, so that the authentication information receiving module of the server side obtains the authentication information packet before receiving the data packet to be sent, thereby performing access control on the data packet to be authenticated. Of course, in other embodiments of the present application, it is also possible to choose to send the authentication data packet and the data packet to be sent at the same time, but the data packet to be sent is only received after the server side authenticates the authentication data packet.

[0053] This application constructs an authentication data packet by obtaining the authentication information of the data packet to be sent. By transmitting the authentication data packet, the server confirms the authentication information of the data packet to be sent, and authenticates the data packet to be sent through the five-tuple and the authentication information carried in the authentication data packet. In addition, the authentication data packet does not need to change the original communication protocol of the business system itself and is independent of the business system. By adopting a plug-in authentication method, the server can perform access verification on the data packet sent by the terminal based on the authentication data packet, thereby improving the communication security of the business system. There is no need to update the communication equipment and communication protocol, reducing the cost of the business system communication upgrade, and at the same time having no additional business impact on the business system.

[0054] The following describes the authentication information transmission method provided by this application using a specific application process of this application:

[0055] If applied to the communication upgrade between the client and the server, there are communication security risks on the current client and the server. After applying the authentication information transmission method provided in this application, you can first configure the authentication message sending module on the terminal (for example, install a plug-in in the terminal) and configure the authentication message receiving module on the server. On the terminal side, the authentication message sending module detects the user's application environment, identity information, etc., and at the same time obtains the five-tuple information of the data packet to be sent in the TCP long connection and the TCP sequence number, and constructs the authentication data packet.

[0056] When communicating with the server, the terminal first transmits an authentication packet. At this time, the terminal can transmit the authentication packet through a third-party line or embed the authentication packet in a TCP persistent connection and send it to the server together with the data packets to be sent.

[0057] The server's authentication message receiving module can first verify the authentication data packet to detect the client's user identity and system environment information. If confirmed to be correct, it will allow the TCP persistent connection corresponding to the authentication information. It can also continue to audit the TCP persistent connection or other access behaviors based on the authentication data packet. If any anomalies are confirmed, access can be blocked in a timely manner.

[0058] See also Figure 2 , Figure 2 This is a schematic diagram of the structure of an authentication information transmission system provided in an embodiment of the present application, the system comprising:

[0059] An authentication information acquisition module, configured to acquire authentication information of a data packet to be sent in a TCP persistent connection; wherein the TCP persistent connection is a TCP persistent connection established between a client in the terminal and a server end of the server;

[0060] an authentication data construction module, configured to construct an authentication data packet, wherein the authentication data packet includes: a five-tuple of the data packet to be sent and authentication information, and the data packet to be sent also includes a TCP sequence number or a TCP sequence number range;

[0061] The communication module is used to send the authentication data packet to the authentication information receiving module of the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server.

[0062] Based on the above embodiment, as a preferred embodiment, the communication module is a module for sending the authentication data packet to the authentication information receiving module based on a third-party connection independent of the TCP long connection.

[0063] Based on the above embodiment, as a preferred embodiment, the authentication information transmission system further includes:

[0064] The authentication data packet identification module is used to identify the authentication data packet as an authentication data packet by setting the TCP sequence number of the authentication data packet to an illegal sequence number.

[0065] Based on the above embodiment, as a preferred embodiment, the authentication information transmission system may further include:

[0066] The data packet sending time setting module is used to set the sending time of the authentication data packet to be earlier than the sending time of the corresponding data packet to be sent, so that the authentication information receiving module obtains the authentication information before receiving the data packet to be sent, thereby performing access control.

[0067] The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, can implement the steps of the method provided in the above embodiment. The storage medium may include: a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program code.

[0068] The present application also provides an electronic device, which may include a memory and a processor. The memory stores a computer program, and when the processor calls the computer program in the memory, the steps of the method provided in the above embodiment can be implemented. Of course, the electronic device may also include various network interfaces, power supplies and other components. Figure 3 , Figure 3 This is a structural diagram of an electronic device provided in an embodiment of the present application. The electronic device in this embodiment may include: a processor 2101 and a memory 2102.

[0069] Optionally, the electronic device may further include a communication interface 2103 , an input unit 2104 , a display 2105 and a communication bus 2106 .

[0070] The processor 2101 , the memory 2102 , the communication interface 2103 , the input unit 2104 , and the display 2105 all communicate with each other via the communication bus 2106 .

[0071] In the embodiment of the present application, the processor 2101 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a readily available programmable gate array, or other programmable logic devices.

[0072] The processor may call a program stored in the memory 2102. Specifically, the processor may execute the operations executed by the terminal in the above embodiment.

[0073] The memory 2102 is used to store one or more programs. The programs may include program codes, and the program codes include computer operating instructions. In the embodiment of the present application, the memory stores at least a program for implementing the following functions:

[0074] Obtaining authentication information of a data packet to be sent in a TCP persistent connection; wherein the TCP persistent connection is a TCP persistent connection established between a client in the terminal and a server end of the server;

[0075] Constructing an authentication data packet, wherein the authentication data packet includes: a quintuple of the data packet to be sent and authentication information, and the data packet to be sent also includes a TCP sequence number or a TCP sequence number range;

[0076] The authentication data packet is sent to the authentication information receiving module of the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server. In one possible implementation, the memory 2102 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function, etc.; and the data storage area may store data created during the use of the computer.

[0077] The electronic device can be a single hardware device, such as a PC. However, it can also be a cluster of hardware devices, such as a cloud computing platform. In this case, a virtual machine can be run on the cloud computing platform, and the steps of the method provided in the above embodiment can be executed in the virtual machine to send authentication information related to the virtual machine.

[0078] In addition, the memory 2102 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0079] The communication interface 2103 may be an interface of a communication module, such as an interface of a GSM module.

[0080] The present application may further include a display 2105 and an input unit 2104 and the like.

[0081] Figure 3 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the electronic device may include Figure 3 More or fewer components than shown, or combinations of certain components.

[0082] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems provided in the embodiments, since they correspond to the methods provided in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0083] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above examples is only intended to help understand the method and core ideas of this application. It should be noted that for those skilled in the art, without departing from the principles of this application, various improvements and modifications can be made to this application, and such improvements and modifications also fall within the scope of protection of the claims of this application.

[0084] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

Claims

1. A method for transmitting authentication information, characterized in that: The authentication information sending module is applied to the terminal, and the method includes: Obtaining authentication information of a data packet to be sent in a TCP persistent connection; wherein the TCP persistent connection is a TCP persistent connection established between a client in the terminal and a server end of the server; Constructing an authentication data packet, wherein the authentication data packet includes: a quintuple of the data packet to be sent and authentication information, and the data packet to be sent also includes a TCP sequence number or a TCP sequence number range; The authentication data packet is sent to the authentication information receiving module of the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server.

2. The authentication information transmission method according to claim 1, characterized in that: The authentication information includes at least one of user identity information, session identifier, process information and terminal environment information.

3. The authentication information transmission method according to claim 1, wherein: The authentication information receiving module for sending the authentication data packet to the server includes: The authentication data packet is sent to the authentication information receiving module based on a third-party connection independent of the TCP long connection.

4. The authentication information transmission method according to claim 3, characterized in that: The third-party connection is a UDP connection.

5. The authentication information transmission method according to claim 1, wherein: The authentication information receiving module for sending the authentication data packet to the server includes: Based on the TCP long connection, the authentication data packet is sent to the authentication information receiving module of the server; wherein the five-tuple of the authentication data packet is consistent with the five-tuple of the long connection, and carries authentication data packet identification information to indicate that it is an authentication data packet.

6. The authentication information transmission method according to claim 5, characterized in that: The authentication data packet is identified as an authentication data packet by setting the TCP sequence number of the authentication data packet to an illegal sequence number.

7. The authentication information transmission method according to any one of claims 1 to 6, characterized in that: The sending time of the authentication data packet is earlier than the sending time of the corresponding data packet to be sent, so that the authentication information receiving module obtains the authentication information before receiving the data packet to be sent, thereby performing access control.

8. An authentication information transmission system, characterized in that: include: An authentication information acquisition module is used to obtain authentication information of a data packet to be sent in a TCP persistent connection; wherein the TCP persistent connection is a TCP persistent connection established between a client in a terminal and a server end of a server; an authentication data construction module, configured to construct an authentication data packet, wherein the authentication data packet includes: a five-tuple of the data packet to be sent and authentication information, and the data packet to be sent also includes a TCP sequence number or a TCP sequence number range; The communication module is used to send the authentication data packet to the authentication information receiving module of the server, so that the authentication information receiving module can confirm the authentication information of the data packet received by the server.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the authentication information transmission method according to any one of claims 1 to 7 are implemented.

10. An electronic device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the authentication information transmission method according to any one of claims 1 to 7 are implemented.

Images